jsleemaster · jsleemaster · Jul 13, 2026 · Jul 13, 2026 · Jul 13, 2026 · Jul 13, 2026
diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "gooblin",
-  "version": "1.3.1",
+  "version": "1.3.2",
   "description": "A geeky product-engineering team for AI coding agents.",
   "author": {
     "name": "jsleemaster",

diff --git a/.codex-plugin/plugin.json b/.codex-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "gooblin",
-  "version": "1.3.1",
+  "version": "1.3.2",
   "description": "A geeky product-engineering team for AI coding agents.",
   "author": "jsleemaster",
   "homepage": "https://jsleemaster.github.io/gooblin/",

diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
@@ -20,11 +20,21 @@ jobs:
     steps:
       - name: Check out repository
         uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
 
       - name: Set up Node
         uses: actions/setup-node@v4
         with:
           node-version: ${{ matrix.node-version }}
 
+      - name: Check diff whitespace
+        if: matrix.node-version == 24
+        run: git diff --check HEAD^ HEAD
+
       - name: Run validation
         run: npm run validate
+
+      - name: Check package payload
+        if: matrix.node-version == 24
+        run: npm pack --dry-run
diff --git a/README.md b/README.md
@@ -11,7 +11,7 @@
 </p>
 
 <p align="center">
-  <img alt="version 1.3.1" src="https://img.shields.io/badge/version-1.3.1-111111">
+  <img alt="version 1.3.2" src="https://img.shields.io/badge/version-1.3.2-111111">
   <img alt="license MIT" src="https://img.shields.io/badge/license-MIT-111111">
   <img alt="plugin style" src="https://img.shields.io/badge/plugin--style-yes-111111">
   <img alt="agent skills" src="https://img.shields.io/badge/agent--skills-yes-111111">
@@ -141,16 +141,16 @@ npx gooblin install
 
 Current status:
 
-- npm registry shorthand `gooblin@1.3.1` is published, but its destructive lifecycle commands are unsafe: it predates the refusal guard in this repository. Until a fixed version is published, do not run `npx gooblin install --force` or `npx gooblin uninstall` from the registry package.
-- The GitHub-source installer contains the refusal guard and remains available for users who need the source version.
+- Source package version `gooblin@1.3.2` contains the destructive-operation refusal guard.
+- Before using registry lifecycle commands, run `npx --yes gooblin --version`. Version 1.3.1 does not contain the guard; use those commands only after the resolved version is 1.3.2 or newer.
 
 Repository-source fallback:
 
 ```bash
 npx github:jsleemaster/gooblin install
 ```
 
-The source installer writes `.gooblin/` in the target project. It does not enable hooks, edit host settings, access the network, or collect telemetry. Use `--dry-run`, `--target <dir>`, and `status` to inspect the copy. Until ownership manifests are implemented in [#49](https://github.com/jsleemaster/gooblin/issues/49), this source version refuses `--force` replacement and `uninstall`. The published npm 1.3.1 package does **not** contain that guard; [#57](https://github.com/jsleemaster/gooblin/issues/57) remains open until a fixed registry version is published and verified.
+The 1.3.2 source installer writes `.gooblin/` in the target project. It does not enable hooks, edit host settings, access the network, or collect telemetry. Use `--dry-run`, `--target <dir>`, and `status` to inspect the copy. Until ownership manifests are implemented in [#49](https://github.com/jsleemaster/gooblin/issues/49), version 1.3.2 and newer refuse `--force` replacement and `uninstall`. Version 1.3.1 does **not** contain that guard; verify the resolved version before using registry lifecycle commands.
 
 ### Manual fallback
 

diff --git a/docs/compatibility.md b/docs/compatibility.md
@@ -2,7 +2,7 @@
 
 These notes record what has actually been checked. They are not marketplace approval claims.
 
-Current package version: `1.3.1`. The latest plugin installer verification below remains the last checked installer result and may lag current package metadata until rechecked.
+Current source package version: `1.3.2`. Registry state must be checked separately with `npm view gooblin version dist-tags --json`; version 1.3.1 lacks the destructive-operation guard and version 1.3.2 includes it. The latest plugin installer verification below remains the last checked installer result and may lag current package metadata until rechecked.
 
 ## Latest Local Verification
 
@@ -38,15 +38,15 @@ Result: `gooblin@gooblin` installed with version `1.2.0` and status `installed,
 
 ## npx Installer Status
 
-Release `v1.3.1` verifies the npm registry shorthand for the minimal dependency-free bin installer:
+At 1.3.2 release preparation on 2026-07-13, published npm `v1.3.1` was the last verified registry version. Its previously verified fresh-copy command was:
 
 ```bash
 npx gooblin install
 ```
 
 The installer copies readable Gooblin files into `.gooblin/` and does not enable hooks, edit host settings, access the network, or collect telemetry.
 
-Safety boundary: published npm 1.3.1 predates the destructive-operation refusal guard. Its fresh-copy path is available, but do not run `install --force` or `uninstall` from that registry package. The repository-source installer contains the guard; #57 stays open until a fixed npm version is published and verified.
+Safety boundary: version 1.3.1 predates the destructive-operation refusal guard. Its fresh-copy path is available, but do not run `install --force` or `uninstall` with that version. Version 1.3.2 and newer contain the refusal guard; verify the resolved registry version before lifecycle commands.
 
 Repository-source fallback remains available:
 

diff --git a/docs/install.md b/docs/install.md
@@ -51,8 +51,8 @@ Current status:
 
 | Path | Status |
 | --- | --- |
-| `npx gooblin install` | Published npm 1.3.1 supports fresh copies, but its `install --force` and `uninstall` paths can delete consumer-owned files. Do not use those lifecycle commands. |
-| `npx github:jsleemaster/gooblin install` | Repository-source fallback containing the temporary destructive-operation refusal guard. |
+| `npx gooblin install` | Registry behavior depends on the resolved version. Version 1.3.1 can delete consumer-owned files through `install --force` and `uninstall`; version 1.3.2 and newer refuse those operations. |
+| `npx github:jsleemaster/gooblin install` | Repository-source version 1.3.2 containing the temporary destructive-operation refusal guard. |
 
 The installer copies a readable skill pack into `.gooblin/` in the current working directory. It copies:
 
@@ -74,7 +74,7 @@ npx gooblin status
 npx gooblin uninstall
 ```
 
-Temporary safety guard: the source installer in this repository refuses `install --force` and `uninstall` because the current marker cannot distinguish installed files from consumer-owned additions or edits. Published npm 1.3.1 predates this guard; do not use those two registry-package lifecycle commands. Back up and review `.gooblin/` manually until [#57](https://github.com/jsleemaster/gooblin/issues/57) publishes and verifies a fixed version. Ownership-aware lifecycle support remains tracked in [#49](https://github.com/jsleemaster/gooblin/issues/49).
+Temporary safety guard: version 1.3.2 and newer refuse `install --force` and `uninstall` because the current marker cannot distinguish installed files from consumer-owned additions or edits. Version 1.3.1 predates this guard. Run `npx --yes gooblin --version` and do not use those lifecycle commands unless the resolved registry version is 1.3.2 or newer. Ownership-aware lifecycle support remains tracked in [#49](https://github.com/jsleemaster/gooblin/issues/49).
 
 Repository-source fallback:
 
@@ -211,4 +211,4 @@ Use the npx skill-pack installer or the manual fallback path. Gooblin is designe
 
 Gooblin hooks are reminder-only. They do not access the network, collect telemetry, run dangerous commands, or mutate user files automatically.
 
-The npx installer is also local-only. A fresh install writes only `.gooblin/` in the target project unless you explicitly choose another target path. The source installer refuses automatic replacement and removal while file ownership cannot be verified; published npm 1.3.1 does not yet include that protection.
+The npx installer is also local-only. A fresh install writes only `.gooblin/` in the target project unless you explicitly choose another target path. Version 1.3.2 and newer refuse automatic replacement and removal while file ownership cannot be verified; version 1.3.1 does not include that protection.
diff --git a/docs/operations.md b/docs/operations.md
@@ -15,7 +15,7 @@ codex plugin list
 Expected shape when installed:
 
 ```text
-gooblin@gooblin  installed, enabled  1.3.1
+gooblin@gooblin  installed, enabled  1.3.2
 ```
 
 Claude Code:
@@ -28,7 +28,7 @@ Expected shape when installed:
 
 ```text
 gooblin@gooblin
-Version: 1.3.1
+Version: 1.3.2
 Status: enabled
 ```
 
@@ -98,7 +98,7 @@ npx skill-pack copy:
 npx gooblin uninstall
 ```
 
-The source installer in this repository refuses automatic removal and leaves `.gooblin/` unchanged. Published npm 1.3.1 predates this guard and can recursively delete the directory, so do **not** run the registry-package uninstall command. Back up the directory, inspect consumer-added or modified files, and remove only files you have confirmed are disposable. A fixed registry release is tracked in [#57](https://github.com/jsleemaster/gooblin/issues/57); ownership-aware uninstall is tracked in [#49](https://github.com/jsleemaster/gooblin/issues/49).
+Version 1.3.2 and newer refuse automatic removal and leave `.gooblin/` unchanged. Version 1.3.1 predates this guard and can recursively delete the directory, so do **not** run its uninstall command. Confirm the resolved registry version with `npx --yes gooblin --version`, back up the directory, and inspect consumer-added or modified files. Ownership-aware uninstall is tracked in [#49](https://github.com/jsleemaster/gooblin/issues/49).
 
 Global package metadata:
 
@@ -132,7 +132,7 @@ If plugin installation breaks, remove the plugin and marketplace entry, then use
 Use /gooblin for this task. Diagnose the task type first, then route to the smallest useful teammate set.
 ```
 
-If an npx copy breaks, first back up `.gooblin/`, then inspect it for consumer-added or modified files. The repository-source `uninstall` command intentionally refuses automatic deletion. Published npm 1.3.1 does not contain that refusal, so do not use its uninstall path; remove files manually only after confirming they are disposable.
+If an npx copy breaks, first back up `.gooblin/`, then inspect it for consumer-added or modified files. Version 1.3.2 and newer intentionally refuse automatic deletion. Version 1.3.1 does not contain that refusal, so do not use its uninstall path; remove files manually only after confirming they are disposable.
 
 If a host-specific statusline setting breaks, remove that host setting. Gooblin does not currently create statusline files or mutate host settings automatically.
 

diff --git a/docs/releases/v1.3.2.md b/docs/releases/v1.3.2.md
@@ -0,0 +1,46 @@
+# Gooblin v1.3.2
+
+Goal: deliver the npx installer data-loss guard to the npm registry without overstating what has been published.
+
+## Changes
+
+- Refuse `install --force` when `.gooblin/` already exists.
+- Refuse automatic `uninstall` until owned-file tracking is available.
+- Keep dry-run operations non-mutating.
+- Verify marked and markerless installs with full-tree path and byte-hash snapshots.
+- Cover consumer-modified installed files and consumer-added files.
+- Run validation on Node.js 18, 20, and 24.
+- Document that npm 1.3.1 predates the guard and require a resolved-version check before lifecycle commands.
+
+## Verified Source State
+
+- The safety implementation was merged through [PR #58](https://github.com/jsleemaster/gooblin/pull/58) as commit `b272cb6f4aad5523cc83c2af41aa8575e1a74c1c`.
+- The test-only commit failed as intended in [Validate run 29229998885](https://github.com/jsleemaster/gooblin/actions/runs/29229998885).
+- The fixed PR head passed Node 18, 20, and 24 in [Validate run 29230650426](https://github.com/jsleemaster/gooblin/actions/runs/29230650426).
+- The merged main commit passed in [Validate run 29233659273](https://github.com/jsleemaster/gooblin/actions/runs/29233659273).
+
+## Required Before Publish
+
+- Release PR `npm run validate` succeeds.
+- Release PR `git diff --check` succeeds.
+- Release PR `npm pack --dry-run` succeeds and the payload is reviewed.
+- Version metadata is `1.3.2` across package, plugin, hook, README, compatibility, and operations surfaces.
+- Independent review finds no unsupported publish or compatibility claim.
+- The publish commit is merged to `main`.
+- Current Claude Code and Codex CLI plugin install paths are rechecked from `main`, with exact host versions and results recorded in `docs/verified-install-paths.md`.
+
+## Required After Publish
+
+- `npm view gooblin name version dist-tags --json` reports `1.3.2` and `latest: 1.3.2`.
+- `npx --yes gooblin --version` returns `1.3.2`.
+- A fresh temporary install writes `GOOBLIN_INSTALL.json` with version `1.3.2`.
+- `install --force`, `uninstall`, and `uninstall --force` return nonzero and preserve the full fixture tree byte-for-byte.
+- The immutable `v1.3.2` tag and GitHub release point to the published source commit.
+- README, install, compatibility, operations, and verified-install docs are updated from pre-publish state to exact observed results.
+
+## Not Claimed
+
+- No ownership-aware update or uninstall support; that remains tracked in #49.
+- No complete installed-README link set; the current copy-only installer omits referenced examples, also tracked in #49.
+- No official host vendor support or marketplace approval claim.
+- No performance, cost, or general safety benchmark claim.
diff --git a/docs/verified-install-paths.md b/docs/verified-install-paths.md
@@ -2,7 +2,7 @@
 
 This page separates verified behavior from intended distribution commands.
 
-Current package version: `1.3.1`.
+Current source package version: `1.3.2`. Registry state can change independently; run `npm view gooblin name version dist-tags --json` before npm lifecycle commands. Version `1.3.1` predates the destructive-operation refusal guard.
 
 ## Verified Locally
 
@@ -13,10 +13,10 @@ Checked on 2026-06-29 from `/Users/smlee/Gooblin`.
 | Claude Code | `2.1.96` | `claude plugin marketplace add /Users/smlee/Gooblin`, `claude plugin install gooblin@gooblin --scope user`, `claude plugin list`. |
 | Codex CLI | `0.141.0` | `codex plugin marketplace add /Users/smlee/Gooblin --json`, `codex plugin add gooblin@gooblin --json`, `codex plugin list`. |
 
-Expected local result for current package version v1.3.1:
+Expected local result for source package version v1.3.2:
 
-- Claude Code: `gooblin@gooblin`, version `1.3.1`, status `enabled`.
-- Codex CLI: `gooblin@gooblin`, version `1.3.1`, status `installed, enabled`.
+- Claude Code: `gooblin@gooblin`, version `1.3.2`, status `enabled`.
+- Codex CLI: `gooblin@gooblin`, version `1.3.2`, status `installed, enabled`.
 
 ## Verified From Git Branch
 
@@ -64,7 +64,7 @@ Verified checks:
 
 Release v1.3.1 updates the public README and docs so the npm package page no longer describes the shorthand as future work.
 
-Safety boundary: npm 1.3.1 can perform recursive replacement/removal because it predates the refusal guard. Its fresh-install check above does not verify safe update or uninstall behavior. Do not run `npx gooblin install --force` or `npx gooblin uninstall` until #57 publishes and verifies a fixed registry version.
+Safety boundary: npm 1.3.1 can perform recursive replacement/removal because it predates the refusal guard. Its fresh-install check above does not verify safe update or uninstall behavior. The 1.3.2 source package refuses both operations. Before any npm lifecycle command, run `npx --yes gooblin --version`; do not run `install --force` or `uninstall` when it resolves to 1.3.1.
 
 ## Intended Remote Commands
 

diff --git a/hooks/claude-codex-hooks.json b/hooks/claude-codex-hooks.json
@@ -1,6 +1,6 @@
 {
   "name": "gooblin-hooks",
-  "version": "1.3.1",
+  "version": "1.3.2",
   "description": "Reminder-only lifecycle hooks for Gooblin mode. Supports GOOBLIN_DISABLE and GOOBLIN_HOOK_MODE.",
   "hooks": {
     "SessionStart": [

diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "gooblin",
-  "version": "1.3.1",
+  "version": "1.3.2",
   "description": "A geeky product-engineering team for AI coding agents.",
   "license": "MIT",
   "repository": {

diff --git a/plugin.yaml b/plugin.yaml
@@ -1,5 +1,5 @@
 name: gooblin
-version: 1.3.1
+version: 1.3.2
 description: A geeky product-engineering team for AI coding agents.
 author: jsleemaster
 license: MIT